Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
Detection of persistent WebSocket connections using libwebsockets to C2.
Detects InvisibleFerret decoding XOR-encoded C2 IP strings.
Detects network connections to 'bsc-testnet.drpc.org', which has been associated with ClearFake and Etherhiding malware campaigns. This domain is used for command and control or data exfiltration related to these threats.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Detects anomalous outbound network connections originating from the Python/vLLM process to irregular ports or cloud metadata IPs. This behavior may indicate command-and-control establishment, secondary staging, or cloud metadata pivoting following a successful CVE-2026-22778 exploit.
Detects modern systems generating HTTP traffic using a hardcoded, outdated Internet Explorer 8 User-Agent string, which is indicative of malware beaconing.
Identifies suspicious access to Steam configuration files (loginusers.vdf) by processes other than legitimate Steam applications, combined with network connections to known malicious URLs associated with token theft. This rule aims to detect injected or hidden wrappers attempting to steal Steam tokens.
Detects CI/CD runners utilizing inline base64 decoding to execute malware payloads, specifically looking for processes that use 'base64 -d' in their command line and also initiate network connections to a known malicious IP address (216.126.225.129) while using 'curl' or 'wget'.
This rule detects outbound network communication to a known command and control (C2) IP address (193.42.11.108) on port 8041, specifically when initiated by processes named 'RuntimeHost.exe' or 'InstallUtil.exe'. This activity is indicative of cryptojacking, potentially leveraging ScreenConnect for initial access or persistence, as described in the referenced Microsoft blog.
Flags outbound HTTPS traffic to a specific Azure Blob Storage path ('note1ggbbhggdwa1.blob.core.windows.net/note/ats/') when initiated by 'RuntimeBroker_update.exe'. This pattern is indicative of a dead-drop command and control (C2) mechanism, potentially associated with the 'Operation Dragon Weave' campaign.
This rule detects the execution of 'curl.exe' that initiates a network connection to the domain 'kak.is'. This activity is indicative of the UnregStealer malware attempting to fetch additional components or communicate with its command and control (C2) server.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
This rule detects network connections from internal devices to identified APT Command and Control (C2) IP address ranges over common ports (8080, 443, 21, 22, 23, 25, 445). This traffic pattern is indicative of unauthorized external communication commonly associated with malware or adversary activity.
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
This rule detects the combination of a Node.js process reading a JavaScript file with a 24-character hexadecimal filename, immediately followed by outbound network communication to known command and control (C2) IP addresses associated with the 'easy-day-js' campaign. This behavior is indicative of the Mastra NPM supply chain compromise.
Correlates pythonw.exe network connections with HTTP POST characteristics (if Deep Packet Inspection data available) for data exfil. This rule specifically looks for network connections initiated by 'pythonw.exe' to known malicious domains ('brokeapt.com', 'pan.ssffaa19.xyz').
This rule detects the creation of the 'class-wc-subscription-diagnostics.php' backdoor file followed by a network connection to the command and control (C2) domain 'generate.2faplugin.org' within a 30-minute window on the same device. This correlation indicates a potential supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to 2FA exfiltration.
This rule identifies indicators and behaviors associated with KongTuke and PS1Bot campaigns. It specifically looks for network connections to known malicious IPs, domains, and URI paths, as well as the execution or presence of files with known malicious SHA256 hashes associated with these campaigns. The original description mentions 'finger.exe abuse, scheduled task and registry persistence, dynamic C# compilation for keylogging/screen capture, and suspicious PowerShell download cradles', but the current KQL rule only covers network and file/process IOCs.
Page 148 of 190